CVE-2021-29448CWE-79

Stored DOM XSS in Pi-hole Admin Web Interface

High · published April 15, 2021

CVSS v3.1
7.6
EPSS
1%
Percentile
51.3
In the wild
Unconfirmed
What it is

Pi-hole is a Linux network-level advertisement and Internet tracker blocking application. The Stored XSS exists in the Pi-hole Admin portal, which can be exploited by the malicious actor with the network access to DNS server. See the referenced GitHub security advisory for patch details.

The record
Technical detail
CVSS v3.1
7.6 · HIGH
Vector
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:L/I:L/A:H
CVSS v4.0
Not supplied
EPSS
0.00668 · 51.3th percentile
Weakness
CWE-79 · Improper Neutralization of Input During Web Page Generation ('Cross-site Scripting')
Published
2021-04-15T15:25Z
EPSS history
Timeline
  • 15 APR 15:25Z
    Stored DOM XSS in Pi-hole Admin Web Interface
    cvelistv5